Supermarket chains in at least seven European countries have said the temperatures of refrigerators and freezers in dozens of their stores soared overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of losses in France.
Retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems on Monday, and several companies confirmed they had been victims of a cyberattack.
The incidents follow an attack in France last month in which hackers seized control of the cooling units in as many as ۷۰۰ supermarkets, raising their temperatures as high as ۵۰C (۱۲۲F) and causing fires and food losses estimated in the tens of millions of euros.
A growing range of devices, including refrigeration systems, can now be monitored and controlled remotely, leading authorities to particularly fear government-sponsored hybrid attacks in the wake of Russia’s ۲۰۲۲ invasion of Ukraine.
Sweden’s Coop chain told the daily Aftonbladet that six of its stores had been hit, while ICA said it was “aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems”.
An ICA store at Sjöbo in southern Sweden posted that its fridges and freezers had been hacked and their temperature set at ۵۰C. Another in Stockholm said its freezers were broken “due to a ۲am cyberattack” and that “everything was destroyed.”
The head of the national cybersecurity centre, John Billow, said it was working on incidents around Sweden. It had established the country had “quite a lot of exposed operational technology devices” that needed updating or patching, he told Reuters.
The Dutch retailer Ahold Delhaize, which last month reported a similar incident to police in the Netherlands, said fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg had been hit.
It did not specify the cause, but reporters visiting a store north-east of Brussels saw refrigerators and freezers empty and a sign reading: “Due to cyberattacks, there will be no products on the refrigerated or freezer shelves. We offer our sincere apologies.”
A company spokesperson, Sarah De Meester, said the range of fresh and frozen products was “temporarily somewhat limited” in affected stores, but that distribution centres were operating normally and there was no disruption to deliveries.
Belgium’s Le Soir newspaper reported that dozens of stores and supermarkets had been affected, including five Spar outlets, Shop & Go convenience stores attached to Q۸ service stations and some smaller Proxy Delhaize mini-markets.
“We started mobilising technicians at ۱am,” Stephan Moelans, the chief executive of Sabcobel, which operates Delhaize’s refrigeration systems, told the paper. “We spent all night and morning disconnecting the affected installations.”
He told the Belga news agency the incident had been a cyber-attack and that the units’ evaporators were switched to defrost mode.
The Colruyt and Intermarché supermarket chains also said they had been hit by technical problems affecting fridges in five and ۱۵ of their stores respectively, and Carrefour Belgium reported disruption in about ۱۵ of its ۷۰۰ stores.
“It’s a cyber-attack, there is no other reason,” said Mich Vergauwen, a Carrefour spokesperson. An Ikea Belgium spokesperson likewise told Agence France-Presse that a cyber-attack had caused the temperature of freezers in its Mons store to rise suddenly.
Ikea, famous for its in-store Swedish meatballs, said it had had to remove some food products from refrigeration units as a precaution and expected some food waste as a result.
after newsletter promotion
In Finland, the Helsingin Sanomat newspaper said stores operated by the Kesko supermarket chain were investigating similar problems, while the Dutch public radio NOS reported that the systems of at least ۱۷ mainly small local stores had been affected.
At one Estonian supermarket chain, attackers accessed a computer controlling the refrigeration system and turned up the temperature to ۵۰C, the refrigeration supply company Kitman Coldtech told the ERR broadcaster.
“This is very fresh, it happened this morning,” its chief executive, Jann Mutso, said, adding that the attack was responded to within minutes and there had been no significant damage. The Selver supermarket chain said one of its outlets had been affected.
Ireland’s third-largest supermarket chain, SuperValu, said refrigeration systems limited to a specific model in ۱۳ of its ۲۲۳ stores had been affected by a cyber-incident, and that chilled and frozen products had been removed from sale.
Many cyber-attacks involve extortion or are politically motivated and are potentially carried out by state-level actors, said Tom Hegel of the cybersecurity firm SentinelOne. But the supermarket attacks, with no financial demands, point to sabotage, he said.
“Retail is an easy target because retail chains run enormous estates of refrigeration controllers, building management systems, door access panels and point-of-sale gear,” Hegel told Reuters.
Patrick Lamplmair of the cybersecurity firm Tributech said cyber-attackers would keep going “until it stops working” because the method was “cheap and the damage is immediate”. Many refrigeration systems had knownand as yet unfixed flaws, he said.
“Thousands of these controllers were still reachable from the internet after the French attack,” he said. “A few commands to a temperature controller can destroy stock overnight and close stores.”
In the French attack, the hackers pirated controllers mostly supplied by the Danish company Danfoss, which said subsequently that it had identified some security flaws last year and had “long recommended” customers install updates.
The hackers remotely overrode the settings on thousands of freezers, fridges and chiller cabinets at chains including Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix, pushing them from as low as -۲۷C to well over ۵۰C.
The stores had to discard vast quantities of fresh meat, dairy and frozen products. Individual supermarkets reportedly suffered losses ranging from tens of thousands of euros to more than €۱۳۰,۰۰۰ (£۱۰۹,۰۰۰).
The Paris prosecutor’s office has opened a formal investigation into the French attack and the prime minister, Sébastien Lecornu, instructed France’s national cybersecurity agency, Ansii, to investigate.
The agency subsequently reported that supermarkets using controllers from two other companies had also been targeted in the attack, but authorities have not indicated who could have been behind the incidents. There have been no claims of responsibility.
